🎙️ How I AI: Build an AI code review bot in 30 minutes + Claude Code for normal people

Build an AI code review bot in 30 minutes with Vercel Eve

Brought to you by:

WorkOS—Make your app enterprise-ready today

Claire built an AI agent that reviews pull requests, scores their risk, auto-approves the safest ones, and sends anything questionable to Slack. In this episode, she breaks down how she built the entire thing in one Codex session using Vercel Eve, and why letting AI review AI-generated code may be a lot less risky than it sounds.

Biggest takeaways:

1. You don’t need a human to review every AI-generated PR. That may sound reckless, but it’s increasingly looking like the smarter operating model. Intercom has already shown this can work at scale: PRs approved by its AI system move five times as fast as human-reviewed ones and have a lower revert rate. In other words, the AI-reviewed code isn’t just shipping faster—it’s less likely to need fixing after it reaches production.

2. The key is having a clear way to separate changes that can skip human review from ones that can’t. The risk model used here scores each PR across six dimensions: the size of the change, its blast radius, how easily it can be reversed, its data and security implications, its operational impact, and whether tests and CI have actually been completed. Anything below 24 points is classified as low risk and cleared by the agent; anything above 64 goes straight to a human for review. The exact numbers matter less than turning a vague judgment call into a repeatable system.

3. Vercel’s Eve may be the fastest way to deploy a serious internal AI agent across Slack and GitHub without spending weeks building infrastructure. It handles the annoying plumbing—connectors, refresh tokens, sandboxing, and routing across channels—so the actual work becomes writing instructions and skills in Markdown instead of babysitting OAuth flows.

4. A useful internal agent can now be built and deployed in a single Codex session, starting with a prompt that’s only a couple of sentences long. In this case, the initial ask was essentially: build a GitHub bot that waits for checks to pass; grades each PR as low, medium, or high risk; and automatically approves the low-risk ones. Everything after that was steering and refinement, not a giant up-front specification.

5. Browser use removes much of the configuration tax that makes agent setup feel harder than it should. Creating a Slack bot and GitHub app manually normally means clicking through endless permission screens, choosing scopes, and managing tokens. Codex handled almost all of that through the browser. The human’s job was mostly to click “save” and complete 2FA. What usually takes hours took minutes.

6. SOC 2 compliance and automatically approved PRs are not inherently at odds. The important part is making the process legible: the risk model needs to be reflected in the company’s code-review and security policies, every decision needs to be logged, and the resulting audit trail needs to be easy to query and defend. The security team’s role is to help design the right framework, not simply block automation because it feels unfamiliar.

7. The operational design matters just as much as the underlying technology. Merge Mommy doesn’t actually merge anything. Instead, it posts a gray check in GitHub as a signal, then sends a Slack message with the risk score and a note saying the PR is ready to approve and merge. That small handoff preserves human accountability for the final action while eliminating most of the cognitive work involved in reviewing a routine change.

8. Evals are what keep internal agents trustworthy after the novelty wears off. Intercom logs every PR review its agent produces and then has an engineer assess whether the score and recommendation were correct. That’s the same discipline strong teams already bring to customer-facing AI products. Internal agents may feel less visible, but when they touch something as important as the codebase, they need the same protection against regressions.

9. The surprising thing about building an Eve agent is how little “building” is actually involved. The full instructions for Merge Mommy fit on roughly a page: a few paragraphs, a handful of bullets, and a short skill file. There isn’t much framework-specific magic to learn. The core skill is simply being able to explain, clearly and precisely, what the agent should do.

Claude Code for normal people: skills, voice mode, and how to collaborate with AI